Security of data transfer
Data on a network can be intercepted, changed or stolen. Networks also spread malware quickly.
Authentication means proving that a user is who they say they are, before they get access.
Common protections: user IDs and passwords, firewalls, encryption of data being sent, and anti-malware software.
Strong and weak passwords
A weak password is short or easy to guess: a name, a birthday, a word from the dictionary, `123456` or `password`.
A strong password is long and mixes upper-case letters, lower-case letters, numbers and symbols. It is not a real word and is not linked to the user.
Each extra character multiplies the number of possible passwords. So length matters most. Type passwords into the checker and watch the time to crack change.
e.g.ExampleAssume an attacker's computer tries 10 billion guesses a second.
8 lower-case letters: 26^8 = about 209 billion options. Cracked in about 21 seconds.
8 characters from all 95 keyboard characters (including the space): 95^8 = about 6.6 × 10^15. About 8 days.
12 characters from all 95: 95^12 = about 5.4 × 10^23. About 1.7 million years.
!Watch outA strong password is still unsafe if it is reused on many sites, written on a sticky note, or never changed after a data breach.
There is something to try for this step in the IGCSE library.
Passwords and biometrics
Passwords are the most common method. They are cheap and easy, but can be guessed, forgotten, seen by shoulder surfing or stolen by spyware.
Biometrics use a unique part of a person's body or behaviour: fingerprint, face, iris or retina, voice or handwriting.
?Why?Biometrics are more secure than passwords because a body feature cannot be forgotten, shared or easily guessed.
Cards and tokens
A magnetic stripe card holds data such as a staff ID on its stripe. It is swiped to open doors. Cheap, but easy to copy and damaged by magnets.
A smart card has a chip that stores and processes data, often with an RFID antenna. It is harder to copy and can hold more data. Often used with a PIN.
A physical token is a small device that shows a one-time password (OTP). Some need the user's PIN first. Banks use them for online banking.
An electronic token is software, usually an app on a phone, that creates a one-time code or approves a log-in. Codes change every 30 to 60 seconds, so a stolen code is soon useless.
e.g.ExampleLogging in to online banking:
1. Type user ID and password (something you know).
2. Open the bank's app, which shows a 6-digit code that changes every 30 seconds (something you have).
3. Type the code. Two different factors make it much harder for a hacker.
!Watch outA token's code is a one-time password. Say why it helps: even if it is intercepted, it cannot be used again.
Zero login
Zero login is a way of authenticating without typing anything. The system recognises the user from biometrics and behaviour, such as how they hold the phone, how they type and where they usually are.
Advantage: very convenient, and nothing to forget.
Disadvantage: the system collects lots of personal data, users may not know they are being tracked, and it is harder to tell how secure it is.
Anti-malware
Malware is software designed to harm a computer or steal data, such as viruses, spyware and ransomware.
Anti-malware software (including anti-virus) scans files and emails, compares them with a database of known malware signatures, and watches for suspicious behaviour.
Infected files are quarantined (isolated so they cannot run) or deleted. The software must be updated regularly so it knows about new malware.
?Why?On a network, one infected computer can infect all the others, so every device needs up-to-date anti-malware.
Electronic conferencing
Video conferencing uses webcams, microphones, speakers and screens so people in different places can see and hear each other live.
Audio conferencing uses only sound: a phone call with three or more people, or an internet call with no video. Participants often dial a number and type a PIN.
Web conferencing (webinars) runs in a browser or app. As well as video and audio, users can share screens, chat by text, use a whiteboard and vote.
e.g.ExampleAudio conferencing is cheaper and needs less bandwidth than video, but people cannot see slides or faces.
Web conferencing lets a teacher share a presentation and run a poll, which audio-only cannot do.